Signed Windows Builds (Azure Artifact Signing)

Version: 4.37.0 Date: 2026-07-15

Goal: Stop SmartScreen and endpoint security (e.g. Cortex XDR) from blocking unsigned Windows installers and auto-updates.

Solution: Authenticode signing via Azure Artifact Signing + jsign on Linux CI; WIN_SIGN flag gates signing to release jobs only.

Features:

• Installer, app executable and uninstaller signed as BLOCKCHAINYOURIP (SHA-256, timestamped)
• verifyUpdateCodeSignature enabled for auto-updates
• Feat/snapshot builds stay unsigned (WIN_SIGN default off)

Files Modified:

• package.json - win.signtoolOptions, verifyUpdateCodeSignature
• package_scripts/sign-windows.cjs (new) - jsign hook
• .gitlab-ci.yml - .windows_sign template, release job wiring, ci-builder:3.2
• docker/Dockerfile - JRE for jsign

Release fragment: feat-win-code-signing